HONG KONG SAR, CHINA Law and Practice Contributed by: Pang Lee, Joyce Wang, Mark Liang and Francis Li, Cooley
collaborative, risk-controlled environment that allows innovative enterprises to leverage their intangible IP assets for credit financing, such as patents and copy- rights. The Generative Artificial Intelligence (GenA.I.) Sandbox Originally launched by the HKMA in collaboration with Cyberport on 13 August 2024 for the banking sector, this Sandbox provided a risk-controlled environment for authorised institutions to test GenA.I. use cases, particularly focusing on risk management, anti-fraud and customer experience. Building on early suc- cesses, the initiative was significantly expanded on 5 March 2026, into the “GenA.I. Sandbox++” co-led by the HKMA, the SFC, the IA and the Mandatory Provi- dent Fund Schemes Authority to cover more sectors. Participants receive targeted supervisory guidance and complimentary access to graphics processing unit (GPU) computing resources at Cyberport’s AI Supercomputing Centre to accelerate responsible AI adoption, including exploring strategies to automate quality and risk checks. The IA Sandbox The IA launched an Insurtech Sandbox in 2017 to facil- itate a pilot run of innovative insurtech applications by certain authorised insurers if they are uncertain about the compliance of initiatives that apply innova- tive technologies, including DLT. The IA expanded the participant scope to include licensed insurance broker companies in 2021. 1.1.3 Regulation of Blockchain Technology The general attitude of the government and regulatory authorities towards industries based on blockchain is highly encouraging of institutional, enterprise and sustainable use cases, while simultaneously enforcing zero-tolerance policies against fraud, market manipu- lation and money laundering risks. The administration employs a dual-policy approach. The SFC’s ASPIRe framework (Access, Safeguards, Products, Infrastruc- ture and Relationships), kicking off on 19 February 2025, prioritises compliance, market integrity and the bridging of traditional finance with blockchain infra- structure.
Concurrently, the “LEAP” framework of the Financial Services and the Treasury Bureau (FSTB), introduced in the Policy Statement 2.0 on the Development of Digital Assets in Hong Kong on 26 June 2025, focuses on streamlining legal structures, expanding tokenised products and embedding the Web3 ecosystem into the real economy. The issuance of tokenised tradi- tional assets, enterprise DLT deployment and regu- lated stablecoin issuance are heavily encouraged. Conversely, unregulated initial coin offerings (ICOs), algorithmic stablecoins marketed to retail investors and the distribution of complex, highly leveraged derivatives to non-professional investors are strictly prohibited. When blockchain technology is utilised independently of crypto-assets – eg, for enterprise data management, internal bank reconciliation or supply chain tracking – it is regulated under standard technology, outsourcing and data protection frameworks rather than special- ised financial legislation. The HKMA provides specific guidance to authorised institutions regarding the use of DLT and cloud computing. Regulated firms out- sourcing critical functions to blockchain technology- enabled solutions must ensure sufficient emphasis on cyber risk within their governance frameworks. They must holistically identify and assess vulnerabilities and maintain proper contractual agreements that allow for regular audits, penetration testing and effectiveness evaluations throughout the entire third-party manage- ment life cycle. Data privacy laws apply rigorously to the use of block- chain-based products and services. In Hong Kong, the Personal Data (Privacy) Ordinance (Chapter 486) governs the collection, processing and handling of personal data. The inherent immutability of blockchain technology directly conflicts with core privacy princi- ples, particularly the data minimisation principle and the conceptual “right to be forgotten”, as the retroac- tive alteration or deletion of stored data is technically unfeasible once recorded on a distributed ledger. The Office of the Privacy Commissioner for Personal Data (PCPD) and the HKMA explicitly advise against the direct storage of personal data on the blockchain. Market participants are strongly encouraged to employ a bifurcated architecture: storing only cryptographic
291 CHAMBERS.COM
Powered by FlippingBook